Re: [PATCH bpf-next v3 3/6] bpf: Allow subprogs to return arena pointers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The verifier incorrectly marks the return value of global subprograms returning arena pointers as `SCALAR_VALUE` in the caller's state, preventing native pointer use.
--

commit 3756bfe1c313ae3bcfb27afcfb3650b07638ef91
Author: Emil Tsalapatis <emil@etsalapatis.com>

bpf: Allow subprogs to return arena pointers

This commit expands the verifier to permit returning an arena pointer to the
caller from a subprogram. It updates btf_validate_return_type and
check_global_subprog_return_code to allow subprograms to return PTR_TO_ARENA
without failing their own verification.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 3a270bc485c20..9dac790905b63 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -16651,6 +16651,10 @@ static int check_global_subprog_return_code(struct bpf_verifier_env *env)
>  	if (err)
>  		return err;
>  
> +	/* Pointers to arena are safe to pass between subprograms. */
> +	if (is_arena_reg(env, BPF_REG_0))
> +		return 0;
> +

[Severity: Medium]
Will this change be sufficient for the caller to actually receive a
PTR_TO_ARENA?

Looking at the caller-side logic in check_func_call(), it appears BPF_REG_0
is still unconditionally marked as a SCALAR_VALUE for all non-void global
subprograms:

kernel/bpf/verifier.c:check_func_call() {
    ...
		/* All non-void global functions return a 64-bit SCALAR_VALUE. */
		if (!subprog_returns_void(env, subprog)) {
			mark_reg_unknown(env, caller->regs, BPF_REG_0);
			caller->regs[BPF_REG_0].subreg_def = DEF_NOT_SUBREG;
		}
    ...
}

Could this cause the caller to receive a scalar instead of the intended arena
pointer, leading the verifier to reject subsequent dereferences with an
invalid mem access error?

>  	if (is_pointer_value(env, BPF_REG_0)) {
>  		verbose(env, "R%d leaks addr as return value\n", BPF_REG_0);
>  		return -EACCES;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260602004120.17087-1-emil@etsalapatis.com?part=3